CVE-2019-5853: Memory corruption in regexp length check
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs to get a user to interact with a crafted HTML page. The CVSS vector indicates the attack can be delivered remotely, requires no attacker privileges, and has low attack complexity, but requires user interaction.
What is the potential impact if exploitation succeeds?
Successful exploitation could result in heap corruption. The listed CVSS impact ratings indicate potential high impact to confidentiality, integrity, and availability.
Which software is identified as affected?
The affected software listed is Google Chrome prior to 76.0.3809.87, along with Debian's chromium package.